
A detailed post-mortem of the April 1 Drift Protocol hack: reconstructed attack chain, how social engineering and in-person tactics enabled months-long infiltration, evidence tying the operation to North Korean actors, and a practical checklist for DeFi risk teams.